C++: Track function pointers using local dataflow and accept test changes.

Author: MathiasVP

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -161,6 +161,16 @@ private module Input2 implements Impl::Private::InputSig2 {
     )
   }
 
+  private MemberFunction getFunctionFromType(Expr e) {
+    result.getClassAndName("operator()").getADerivedClass*() = e.getUnspecifiedType()
+  }
+
+  private Function getFunctionFromExpr(Expr e) {
+    result = e.(FunctionAccess).getTarget()
+    or
+    result = e.(ConversionCall).getQualifier().(LambdaExpression).getLambdaFunction()
+  }
+
   class SourceSinkReportingElement extends Element {
     SourceSinkReportingElement() { this instanceof Expr or this instanceof Parameter }
 
@@ -169,29 +179,29 @@ private module Input2 implements Impl::Private::InputSig2 {
         [this.(Expr).getEnclosingFunction(), this.(Parameter).getFunction()]
     }
 
-    /**
-     * Gets the member function corresponding to an overloaded `operator()` when this element is
-     * invoked.
-     */
-    private MemberFunction getOperatorCallFunction() {
-      // An `operator()` on a struct
-      result.getClassAndName("operator()").getADerivedClass*() = this.(Expr).getUnspecifiedType()
-      or
-      // A lambda that has undergone "lambda to function-pointer conversion"
-      result = this.(ConversionCall).getQualifier().(LambdaExpression).getLambdaFunction()
-    }
-
     /** Gets the function invoked when this element is used as a callback. */
-    private Function getCallbackFunction() {
-      // Taking the address of a function
-      result = this.(FunctionAccess).getTarget()
+    private Function getCallable() {
+      // The expression is a struct which implements `operator()`.
+      result = getFunctionFromType(this)
       or
-      // Passing an object with an overloaded `operator()`
-      result = this.getOperatorCallFunction()
+      // The expression is a function pointer
+      result = getFunctionFromExpr(this)
+      or
+      // The expression is an SSA read of an assignment of a callable
+      exists(Ssa::Definition def |
+        def.getAUse().getDef().getUnconvertedResultExpression() = this and
+        result =
+          getFunctionFromExpr(def.getAnUltimateDefinition()
+                .(Ssa::DirectExplicitDefinition)
+                .getAssignedInstruction()
+                .(StoreInstruction)
+                .getSourceValue()
+                .getUnconvertedResultExpression())
+      )
     }
 
     SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) {
-      exists(Function f | f = this.getCallbackFunction() |
+      exists(Function f | f = this.getCallable() |
         exists(ParameterPosition pos | sc = Impl::Private::SummaryComponent::parameter(pos) |
           result = pos.getParameter(f)
         )

cpp/ql/test/library-tests/dataflow/external-models/flow.expected

@@ -245,6 +245,11 @@ edges
 | test.cpp:250:32:250:32 | source_from_callback_template output argument [value] | test.cpp:243:10:243:10 | *s [value] | provenance |  |
 | test.cpp:251:27:251:27 | source_from_callback_ptr output argument | test.cpp:251:27:251:27 | source_from_callback_ptr output argument [value] | provenance | Src:MaD:37  |
 | test.cpp:251:27:251:27 | source_from_callback_ptr output argument [value] | test.cpp:243:10:243:10 | *s [value] | provenance |  |
+| test.cpp:258:12:258:12 | *s [value] | test.cpp:258:15:258:19 | value | provenance |  |
+| test.cpp:258:15:258:19 | value | test.cpp:258:15:258:19 | value | provenance | Sink:MaD:3 |
+| test.cpp:262:27:262:31 | source_from_callback_ptr output argument | test.cpp:262:27:262:31 | source_from_callback_ptr output argument [value] | provenance | Src:MaD:37  |
+| test.cpp:262:27:262:31 | source_from_callback_ptr output argument [value] | test.cpp:243:10:243:10 | *s [value] | provenance |  |
+| test.cpp:262:27:262:31 | source_from_callback_ptr output argument [value] | test.cpp:258:12:258:12 | *s [value] | provenance |  |
 | test.cpp:264:32:266:2 | source_from_callback_template output argument | test.cpp:264:32:266:2 | source_from_callback_template output argument [value] | provenance | Src:MaD:40  |
 | test.cpp:264:32:266:2 | source_from_callback_template output argument [value] | test.cpp:265:11:265:11 | *s [value] | provenance |  |
 | test.cpp:265:11:265:11 | *s [value] | test.cpp:265:14:265:18 | value | provenance |  |
@@ -629,6 +634,11 @@ nodes
 | test.cpp:250:32:250:32 | source_from_callback_template output argument [value] | semmle.label | source_from_callback_template output argument [value] |
 | test.cpp:251:27:251:27 | source_from_callback_ptr output argument | semmle.label | source_from_callback_ptr output argument |
 | test.cpp:251:27:251:27 | source_from_callback_ptr output argument [value] | semmle.label | source_from_callback_ptr output argument [value] |
+| test.cpp:258:12:258:12 | *s [value] | semmle.label | *s [value] |
+| test.cpp:258:15:258:19 | value | semmle.label | value |
+| test.cpp:258:15:258:19 | value | semmle.label | value |
+| test.cpp:262:27:262:31 | source_from_callback_ptr output argument | semmle.label | source_from_callback_ptr output argument |
+| test.cpp:262:27:262:31 | source_from_callback_ptr output argument [value] | semmle.label | source_from_callback_ptr output argument [value] |
 | test.cpp:264:32:266:2 | source_from_callback_template output argument | semmle.label | source_from_callback_template output argument |
 | test.cpp:264:32:266:2 | source_from_callback_template output argument [value] | semmle.label | source_from_callback_template output argument [value] |
 | test.cpp:265:11:265:11 | *s [value] | semmle.label | *s [value] |

cpp/ql/test/library-tests/dataflow/external-models/test.cpp

@@ -240,7 +240,7 @@ using Callback = void(*)(const SourceWrapper*);
 void source_from_callback_ptr(Callback);
 
 void f(const SourceWrapper* s) {
-	ymlSink(s->value); // $ ir=250:32 ir=251:27 MISSING: ir=262:27
+	ymlSink(s->value); // $ ir=250:32 ir=251:27 ir=262:27
 }
 
 void test_source_access_path(bool b) {
@@ -255,7 +255,7 @@ void test_source_access_path(bool b) {
 		f_var = f;
 	} else {
 		f_var = [](const SourceWrapper* s) {
-			ymlSink(s->value); // $ MISSING: ir
+			ymlSink(s->value); // $ ir
 		};
 	}